What is Claimed: 



1 1. A method for the automated implementation of a hierarchical event relationship network 

2 for correlation analysis in a distributed computing environment, comprising the acts of: 

3 inputting event handling information for each event type to be monitored; 

4 customizing a plurality of rule templates for each event type within an event 

5 source; 

6 verifying that the plurality of event relationship network rules do not violate an 

7 event protocol; 

8 y generating a hierarchical class definition structure and naming structure from the 

9 y plurality of event relationship network rules for each event source; and 

pa 

10 =:J generating a plurality of event management rules for each event type automatically 

11 from the event relationship network rules and the rule templates. 

m 

1 Q 2. The method for the automated implementation of a hierarchical event relationship network 

2 for correlation analysis in a distributed computing environment of claim 1 further comprising 

3 the acts of loading the plurality of event management rules into a rule-based event manager. 
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3. The method for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 2 further comprising 
the act of monitoring performance of the rule-based event manager in the distributed 
computing environment. 

4. The method for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 1 wherein the event 
sources include one or more of a hardware device, an operating system, and a software 
application. 

5. The method for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 1 wherein the event 
relationship network includes a series of drawing pages that depict subsets of correlation 
relationships. 

6. The method for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 5 wherein each page 
of the event relationship network is a subnet comprising a set of events. 
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7. The method for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 6 wherein each 
subnet can link to other subnets and span the number of pages required to represent the set 
of correlational relationships. 

8. The method for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 1 wherein the events 
are defined based on a connected graph model. 

9. The method for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 1 wherein the act 
of generating a hierarchical class definition structure comprises the act of automatically 
building Basic Recording of Objects in C (BAROC) files. 

10. The method for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 9 wherein each 
event is redefined using a path identification number and a sequence identification number. 
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1 1. The method for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 10 wherein a 
position of any event on a logical connected graph of events is determine by a path 
identification and a sequence identification. 

12. The method for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 1 1 wherein the path 
identification is a list of integers that represent the set of all paths that flow through an event. 

13. The method for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 1 1 wherein the 
sequence identification is a single integer that represents a relative position of an event on 
a path. 

14. The method for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 1 further comprising 
a plurality of rule sets to handle each event. 
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1 15. The method for the automated implementation of a hierarchical event relationship network 

2 for correlation analysis in a distributed computing environment of claim 14 wherein the 

3 plurality of rule sets includes duplicate detection and trouble ticketing, autonomous events, 

4 primary events, primary/secondary events, secondary events and clearing events. 

1 16. The method for the automated implementation of a hierarchical event relationship network 

2 for correlation analysis in a distributed computing environment of claim 15 wherein an 

3 autonomous event is an isolated event that is not a proximate cause for any other event. 

Q 

1 =vj 17. The method for the automated implementation of a hierarchical event relationship network 

2 ''4 for correlation analysis in a distributed computing environment of claim 15 wherein a 

3 primary event is an event that is a root cause event that has no precedent event and can have 

4 L any number of ancillary resulting events. 

rU 
ru 

1 Q 18. The method for the automated implementation of a hierarchical event relationship network 

2 for correlation analysis in a distributed computing environment of claim 15 wherein a 

3 primary/secondary event is one that can be a causal event or the result of another event distal 

4 to a root cause event. 
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19. The method for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 15 wherein a 
secondary event is an event that can result only from another event that is distal to a root 
cause event. 

20. The method for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 15 wherein a 
clearing event is an event that signals a return to a steady state condition by clearing at least 
one event. 

21. The method for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 16 wherein an 
autonomous event is handled by a single rule defined by a policy. 

22. The method for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 7 wherein each 
subnet comprises any one of an autonomous subnet, a primary subnet, a primary/secondary 
subnet and a secondary subnet. 
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1 23. The method for the automated implementation of a hierarchical event relationship network 

2 for correlation analysis in a distributed computing environment of claim 10 wherein if the 

3 event sequence number is less than that of a known event in a path, then the event is a current 

4 primary event and a previous primary event is removed from further correlation analysis. 

1 24. The method for the automated implementation of a hierarchical event relationship network 

2 for correlation analysis in a distributed computing environment of claim 10 wherein if the 

3 event sequence number is greater than that of a known event in a path, then the event is a 

4 ^ secondary event and is removed from further correlational analysis. 

i 

1 tJ 25. The method for the automated implementation of a hierarchical event relationship network 

2 Ly for correlation analysis in a distributed computing environment of claim 1 wherein the act 

3 of customizing a plurality of rule templates comprises adding, modifying and deleting rule 

4 actions and commands to perform the event management behavior specified by an end user. 
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1 26. A method for the automated generation of a class definition and naming structure from an 

2 event relationship network represented by a hierarchical connected graph to perform 

3 correlation analysis in a distributed computing environment, comprising the acts of: 

4 assigning events in a subnet to a superclass defined with the same name as the subnet; 

5 assigning a path number to connected events in the same subnet; 

6 determining if a branch point has been reached in the connected graph; 

7 if a branch point has been reached, assigning a new path number to the branch, 

8 adding the assigned path number to events that are earlier in the sequence 

9 _ than the branch point, and appending a list of events and assigned path 

10 numbers to a path identification slot for each event; and 

'"'4 

1 1 \^ if a branch point has not been reached, incrementing a sequence number that is 

12 Ly assigned to each event and adding the event sequence numbers to a sequence 

13 identification list. 

ru 
iy 

1 □ 27. The method for the automated generation of a class definition and naming structure from an 

o 

2 event relationship network of claim 26 further comprising the act of determining if there 

3 exists a prior connected subnet for a current subnet. 
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1 28. The method for the automated generation of a class definition and naming structure from an 

2 event relationship network of claim 27 further comprising the acts of: 

3 determining the subset of connected events on the prior connected subnet that lead 

4 to the current subnet; 

5 assigning the subset of events to a subnet ancestor superclass; and 

6 adding the subnet ancestor superclass to an ancestor slot of the current subnet events. 

1 29. The method for the automated generation of a class definition and naming structure from an 

2 event relationship network of claim 27 further comprising the act of determining if there is 

3 'itt a subsequent connected subnet for a current subnet. 

■"5 
lib:: 

S3 

1 i J 30. The method for the automated generation of a class definition and naming structure from an 

2 ii event relationship network of claim 29 further comprising the acts of: 

3 determining the subset of connected events on the subsequent connected subnet that 

4 \^ follow from the current subnet; 

5 assigning the subset of events to a subnet descendant superclass; and 

6 adding the subnet descendant superclass to a descendant slot of the current subnet 

7 events. 
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3 1 . The method for the automated generation of a class definition and naming structure from an 
event relationship network of claim 29 further comprising the act of writing a plurality of 
generated classes to a data file. 



32. The method for the automated generation of a class definition and naming structure from an 
event relationship network of claim 28 wherein the subnet ancestor class contains events that 
are primary to another subnet. 



33. The method for the automated generation of a class definition and naming structure from an 
event relationship network of claim 32 wherein each event assigned to a subnet ancestor 
class is from a distal nodal event to a next most proximal nodal event on an event path. 



34. The method for the automated generation of a class definition and naming structure from an 
event relationship network of claim 33 wherein a nodal event is an event that has a plurality 
of paths flowing from the event. 



35. The method for the automated generation of a class definition and naming structure from an 
event relationship network of claim 34 wherein the distal nodal event is defined as an event 
that is farther away from a root cause event than a specified event on the event path. 
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1 36. The method for the automated generation of a class definition and naming structure from an 

2 event relationship network of claim 34 wherein a proximal nodal event is defined as an event 

3 that is closer to a root cause event than a specified event on the event path. 

4 37. The method for the automated generation of a class definition and naming structure from an 

5 event relationship network of claim 30 wherein the subnet descendant class contains events 

6 that are in a direct flow from a primary subnet entry point. 

1 38. The method for the automated generation of a class definition and naming structure from an 

2 =;j event relationship network of claim 26 further comprising the act of generating a generic 

3 ^ correlation template. 

i:y 

1 39. The method for the automated generation of a class definition and naming structure from an 

2 m event relationship network of claim 38 further comprising the acts of defining a path 

3 i;3 identification slot, a sequence identification slot, a descendant class and an ancestor class in 

□ 

4 a data file immediately descendant from a root cause event. 

1 40. The method for the automated generation of a class definition and naming structure from an 

2 event relationship network of claim 39 wherein the path identification slot is propagated 

3 with a list of path numbers that an event is relevant to in the event relationship network. 
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4 1 . The method for the automated generation of a class definition and naming structure from an 
event relationship network of claim 39 wherein the sequence identification slot is filled with 
a sequence number for the path. 

42. The method for the automated generation of a class definition and naming structure from an 
event relationship network of claim 39 wherein for any event on a subnet which includes a 
primary subnet and that lies in a logical flow connected to the primary subnet, populating 
the ancestor class slot with a list of all subnet ancestor class names which are primary to the 
event and lie on the logical flow. 

43. The method for the automated generation of a class definition and naming structure from an 
event relationship network of claim 39 wherein for any event on a subnet which includes a 
secondary subnet and that lies in a logical flow connected to the secondary event, populating 
the descendant class slot with a list of all subnet descendant class names which are secondary 
to the event and lie on the logical flow. 
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1 44. The method for the automated generation of a class definition and naming structure from an 

2 event relationship network of claim 38 wherein the act of generating a generic correlation 

3 template comprises the acts of: 

4 for an event of a class within a subnet ancestor class: 

5 making a current event on the subnet a secondary event; and 

6 removing the current event from correlation analysis; 

7 for an event of a class within a subnet descendant class: 

8 making the current event on the subnet a primary event; and 

9 removing the current event from correlation analysis; 

10 for an older event on the subnet in which the path identification of the current event 

1 1 intersects the path identification of the older event: 

12 i^y making the current event on the subnet a primary event and removing it from 

IKS" 

13 correlation analysis, if the sequence identification of the current event is less 

14 \^ than the sequence identification of the older event; and 

15 making the current event on the subnet a secondary event and removing it from 

16 " correlation analysis, if the sequence identification of the current event is 

17 greater than the sequence identification of the older event. 
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1 45. The method for the automated generation of a class definition and naming structure from an 

2 event relationship network of claim 40 wherein the propagation of path identification 

3 numbers includes the acts of: 

4 starting at a root node of the event relationship network, proceeding to a nodal event 

5 and defining a path leading in to the nodal event a path identification number 

6 of one; 

7 at the nodal event, continuing the inherited path leading in as one path leading out 

8 from the nodal event and assigning each remaining path leading out from the 

9 nodal event an ascending sequence of path identification numbers; 

10 proceeding to a next nodal event on any path leading out and repeating the acts 

1 1 performed at the nodal event of assigning each remaining path leading out 

12 i j from the nodal event an ascending sequence of path identification numbers; 

, ?^ 

13 i'- and 

) = 

14 ;,r; propagating the path identification numbers backwards to ensure that events on a 

i y 

15 'yv^ path precedent to the nodal event are contained in the list for the path 

16 identification slot. 
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1 46. The method for the automated generation of a class definition and naming structure from an 

2 event relationship network of claim 41 wherein the propagation of sequence identification 

3 numbers includes the acts of: 

4 starting at a root node of the event relationship network, assigning the sequence 

5 numbers down a complete path; 

6 for each nodal event, continuing to assign sequence numbers for each node down any 

7 path by increasing a current sequence identification number of each nodal 

8 event; and 

9 if an event is fed by more than one incoming path, assigning the event a sequence 

10 number that is the highest of each incoming path and increasing the sequence 

1 1 ''4 identification numbers of any events that follow a current nodal event in the 

12 W logical sequence. 

1 m 47. A computer readable medium containing a computer program product for the automated 

2 Q implementation of a hierarchical event relationship network for correlation analysis in a 

I. IS 

3 distributed computing environment, the computer program product comprising: 

4 program instructions that enable inputting event handling information for each event 

5 type to be monitored; 

6 program instructions that customize a plurality of rule templates for each event type 

7 within an event source; 
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8 program instructions that verify that the plurality of event relationship network rules 

9 do not violate an event protocol; 

10 program instructions that generate a hierarchical class definition structure and 

1 1 naming structure from the plurality of event relationship network rules for 

12 each event source; and 

13 program instructions that generate a plurality of event management rules for each 

14 event type automatically from the event relationship network rules and the 

15 rule templates. 

1 48, The computer program product for the automated implementation of a hierarchical event 

2 relationship network for correlation analysis in a distributed computing environment of claim 

3 vy 47 further comprising program instructions that load the plurality of event management rules 

4 into a rule-based event manager. 

ru 
ry 

1 □ 49. The computer program product for the automated implementation of a hierarchical event 

•tar 

2 relationship network for correlation analysis in a distributed computing environment of claim 

3 48 further comprising program instmctions that monitor performance of the rule-based event 

4 manager in the distributed computing environment. 
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1 50. The computer program product for the automated implementation of a hierarchical event 

2 relationship network for correlation analysis in a distributed computing environment of claim 

3 47 further comprising program instructions that define events based on a connected graph 

4 model. 

1 51. The computer program product for the automated implementation of a hierarchical event 

2 relationship network for correlation analysis in a distributed computing environment of claim 

3 47 wherein the program instructions that generate a hierarchical class definition structure 

4 comprise program instructions that automatically build Basic Recording of Objects in C 

5 (BAROC) files. 

1 ! h 52. The computer program product for the automated implementation of a hierarchical event 

2 J* relationship network for correlation analysis in a distributed computing environment of claim 

3 \^ 51 further comprising program instructions that redefine each event using a path 

4 identification number and a sequence identification number. 

1 53. The computer program product for the automated implementation of a hierarchical event 

2 relationship network for correlation analysis in a distributed computing environment of claim 

3 52 further comprising program instrucfions that determine a position of any event on a 

4 logical connected graph of events by a path identificadon and a sequence idenfification. 
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1 54. The computer program product for the automated implementation of a hierarchical event 

2 relationship network for correlation analysis in a distributed computing environment of claim 

3 47 further comprising program instructions that define a plurality of rule sets to handle each 

4 event. 

1 55. The computer program product for the automated implementation of a hierarchical event 

2 relationship network for correlation analysis in a distributed computing environment of claim 

3 54 wherein the plurality of defined rule sets includes duplicate detection and trouble 

4 ticketing, autonomous events, primary events, primary/secondary events, secondary events 

5 'ip and clearing events. 

1 uj 56. The computer program product for the automated implementation of a hierarchical event 

2 ii relationship network for correlation analysis in a distributed computing environment of claim 

3 [H 52 further comprising program instrucfions that determine if the event sequence number is 

4 less than that of a known event in a path, and if so, identify the event as a current primary 
event and remove a previous primary event from further correlation analysis. 
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1 57. The computer program product for the automated implementation of a hierarchical event 

2 relationship network for correlation analysis in a distributed computing environment of claim 

3 52 further comprising program instructions that determine if the event sequence number is 

4 greater than that of a known event in a path, and if so, identify the event as a secondary event 

5 and remove the event from further correlational analysis. 

1 58. The computer program product for the automated implementation of a hierarchical event 

2 relationship network for correlation analysis in a distributed computing environment of claim 

3 47 wherein the program instructions that customize a plurality of rule templates further 

4 ;jO comprise program instructions that add, modify and delete rule actions and commands to 

5 Zi perform the event management behavior specified by an end user. 
UJ 

1 1^ 59. A computer readable medium containing a computer program product for the automated 

1 

2 generation of a class definition and naming structure from an event relationship network 

3 i^-^i represented by a hierarchical connected graph to perform correlation analysis in a distributed 

4 computing environment, the computer program product comprising: 

5 program instructions that assign events in a subnet to a superclass defined with the 

6 same name as the subnet; 

7 program instructions that assign a path number to connected events in the same 

8 subnet; 
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9 program instructions that determine if a branch point has been reached in the 

1 0 connected graph ; 

1 1 program instructions that assign a new path number to the branch, add the assigned 

12 path number to events that are earUer in the sequence than the branch point, 

13 and append a Ust of events and assigned path numbers to a path identification 

14 slot for each event, if a branch point has been reached; and 

15 program instructions that increment a sequence number that is assigned to each event 

16 and add the event sequence numbers to a sequence identification Ust, if a 

17 branch point has not been reached. 

1 4j 60. The computer program product for the automated generation of a class definition and naming 

2 ly structure from an event relationship network of claim 59 further comprising program 

3 f ^ instructions that determine if there exists a prior connected subnet for a current subnet. 

j.JL 
□ 
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1 61. The computer program product for the automated generation of a class definition and naming 

2 structure from an event relationship network of claim 60 further comprising: 

3 program instructions that determine the subset of connected events on the prior 

4 connected subnet that lead to the current subnet; 

5 program instructions that assign the subset of events to a subnet ancestor superclass; 

6 and 

7 program instructions that add the subnet ancestor superclass to an ancestor slot of the 

8 current subnet events. 

1 62. The computer program product for the automated generation of a class definition and 

pa 

2 naming structure from an event relationship network of claim 60 further comprising program 

•pi 

3 ly instructions that determine if there is a subsequent connected subnet for a current subnet. 

1 \^ 63. The computer program product for the automated generation of a class definition and 

2 naming structure from an event relationship network of claim 62 further comprising: 

3 program instructions that determine the subset of connected events on the subsequent 

4 connected subnet that follow from the current subnet; 

5 program instructions that assign the subset of events to a subnet descendant 

6 superclass; and 

7 program instructions that add the subnet descendant superclass to a descendant slot 

8 of the current subnet events. 
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64. The computer program product for the automated generation of a class definition and naming 
structure from an event relationship network of claim 62 further comprising program 
instructions that write a plurality of generated classes to a data file. 

65. The computer program product for the automated generation of a class definition and naming 
structure from an event relationship network of claim 61 wherein the subnet ancestor class 
contains events that are primary to another subnet. 

66. The computer program product for the automated generation of a class definition and naming 
structure from an event relationship network of claim 59 further comprising program 
instructions that generate a generic correlation template. 

67. The computer program product for the automated generation of a class definition and naming 
structure from an event relationship network of claim 66 further comprising program 
instructions that define a path identification slot, a sequence identification slot, a descendant 
class and an ancestor class in a data file immediately descendant from a root cause event. 

68. The computer program product for the automated generation of a class definition and naming 
structure from an event relationship network of claim 67 further comprising program 
instructions that propagate the path identification slot with a list of path numbers that an 
event is relevant to in the event relationship network. 
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5 69. 

6 

7 

8 

9 



1 70. 
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The computer program product for the automated generation of a class definition and naming 
structure from an event relationship network of claim 67 wherein for any event on a subnet 
which includes a primary subnet and that lies in a logical flow connected to the primary 
subnet, program instructions that populate the ancestor class slot with a list of all subnet 
ancestor class names which are primary to the event and lie on the logical flow. 

The computer program product for the automated generation of a class definition and 
naming structure from an event relationship network of claim 67 wherein for any event on 
a subnet which includes a secondary subnet and that lies in a logical flow connected to the 
secondary event, program instructions that populate the descendant class slot with a list of 
all subnet descendant class names which are secondary to the event and lie on the logical 
flow. 

The computer program product for the automated generation of a class definition and naming 
structure from an event relationship network of claim 66 wherein the program instructions 
that generate a generic correlation template comprise: 

for an event of a class within a subnet ancestor class: 



program instructions that make a current event on the subnet a secondary 



event; and 



program instructions that remove the current event from correlation analysis; 



for an event of a class within a subnet descendant class: 
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9 program instructions that make the current event on the subnet a primary 

10 event; and 

1 1 program instructions that remove the current event from correlation analysis; 

12 for an older event on the subnet in which the path identification of the current event 

13 intersects the path identification of the older event: 

14 program instructions that make the current event on the subnet a primary 

15 event and remove it from correlation analysis, if the sequence 

16 identification of the current event is less than the sequence 

17 ^ identification of the older event; and 

18 i'i program instructions that make the current event on the subnet a secondary 

as 

19 y event and remove it from correlation analysis, if the sequence 

20 identification of the current event is greater than the sequence 

2 1 identification of the older event. 

i;u 

1 □ 72. The computer program product for the automated generation of a class definition and naming 

2 structure from an event relationship network of claim 68 wherein the program instructions 

3 that propagate path identification numbers includes: 

4 program instructions that, starting at a root node of the event relationship network, 

5 proceed to a nodal event and define a path leading in to the nodal event with 

6 a path identification number of one; 
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7 

8 

9 
10 
11 
12 
13 
14 
15 
16 

'"'-4 



program instructions that, for the nodal event, continue the inherited path leading in 
as one path leading out from the nodal event and assign each remaining path 
leading out from the nodal event an ascending sequence of path identification 
numbers; 

program instructions that proceed to a next nodal event on any path leading out from 
the nodal event and assign each remaining path leading out from the next 
nodal event an ascending sequence of path identification numbers; and 

program instructions that propagate the path identification numbers backwards to 
ensure that events on a path precedent to the nodal event are contained in the 
list for the path identification slot. 
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1 73. The computer program product for the automated generation of a class definition and naming 

2 structure from an event relationship network of claim 41 wherein the program instructions 

3 that propagate sequence identification numbers includes: 

4 program instructions that, starting at a root node of the event relationship network, 

5 assign the sequence numbers down a complete path; 

6 program instructions that, for each nodal event, continue to assign sequence numbers 

7 for each node down any path by increasing a current sequence identification 

8 number of each nodal event; and 

9 if an event is fed by more than one incoming path, program instructions that assign 

10 sD the event a sequence number that is the highest of each incoming path and 

1 1 increase the sequence identification numbers of any events that follow a 

12 i jj current nodal event in the logical sequence. 

1 74. A system for the automated implementation of a hierarchical event relationship network for 

2 correlation analysis in a distributed computing environment, comprising: 

3 an input component that receives event handling information for each event type to 

4 be monitored; 

5 a customization component that customizes a plurality of rule templates for each 

6 event type within an event source; 

7 a verification component that verifies the plurality of event relationship network 

8 rules do not violate an event protocol; 
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1 r 76. 
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1 77. 

2 

3 

4 



a class generation component that generates a hierarchical class definition structure 

and naming structure from the plurality of event relationship network rules 

for each event source; and 
a rule generation component that generates a plurality of event management rules for 

each event type automatically from the event relationship network rules and 

the rule templates. 

The system for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 74 further 
comprising a component that loads the plurality of event management rules into a rule-based 
event manager. 

The system for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 75 further 
comprising a component that monitors performance of the rule-based event manager in the 
distributed computing environment. 

The method for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 74 wherein the event 
sources include one or more of a hardware device, an operating system, and a software 
application. 
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78. The system for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 74 wherein the 
events are defined based on a connected graph model. 

79. The system for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 74 wherein the class 
generation component comprises a component that automatically builds Basic Recording of 
Objects in C (BAROC) files. 

80. The system for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 78 further 
comprising a component that determines a position of any event on a logical connected graph 
of events by a path identification number and a sequence identification number. 

81. The system for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 74 further 
comprising a component that applies a plurality of rule sets to handle each event. 
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The system for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 81 wherein the 
plurality of rule sets includes duplicate detection and trouble ticketing, autonomous events, 
primary events, primary/secondary events, secondary events and clearing events. 

The system for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 80 further 
comprising a component that determines if the event sequence number is less than that of a 
known event in a path, and if it is, identifies the event as a current primary event and removes 
a previous primary event from further correlation analysis. 

The system for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 80 further 
comprising a component that determines if the event sequence number is greater than that 
of a known event in a path, and if it is, identifies the event as a secondary event and removes 
the event from further correlational analysis. 

The system for the automated implementation of a hierarchical event relationship network 
for correlation analysis in a distributed computing environment of claim 74 wherein the 
customization component comprises a component that adds, modifies and deletes rule 
actions and commands to perform the event management behavior specified by an end user. 
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J 


OO. 


A system for the automated generation of a class definition and naming structure from an 


0 




event relationship network represented by a hierarchical connected graph to perform 


1 




correlation analysis in a distributed computing environment, comprising: 


o 
5 




a component that assigns events in a subnet to a superclass defined with the same 


9 




name as the subnet; 


1 A 




a component that assigns a path number to connected events in the same subnet; 


11 




a component that determines if a branch point has been reached in the connected 


12 




graph; 


1 '2 
1 J 




a component that assigns a new path number to the branch, adds the assigned path 


14 




number to events that are earlier m the sequence than the branch pomt, and 


1 c 

Ij 




appends a list of events and assigned path numbers to a path identification 


1 /I 
16 




slot for each event, if a branch point has been reached; and 


17 




a component that increments a sequence number that is assigned to each event and 


18 




adds the event sequence numbers to a sequence identification list, if a branch 


ly 




point has not been reached. 


1 


87. 


The system for the automated generation of a class definition and naming structure from an 


2 




event relationship network of claim 86 further comprising a component that determines if 


3 




there exists a prior connected subnet for a current subnet. 
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1 88. The method for the automated generation of a class definition and naming structure from an 

2 event relationship network of claim 87 further comprising: 

3 a component that determines the subset of connected events on the prior connected 

4 subnet that lead to the current subnet; 

5 a component that assigns the subset of events to a subnet ancestor superclass; and 

6 a component that adds the subnet ancestor superclass to an ancestor slot of the 

7 current subnet events. 

1 89. The system for the automated generation of a class definition and naming structure from an 

2 event relationship network of claim 87 further comprising a component that determines if 

3 there is a subsequent connected subnet for a current subnet. 

;!}». 

=ty 

1 90. The system for the automated generation of a class definition and naming structure from an 

2 \^ event relationship network of claim 89 further comprising: 

3 a component that determines the subset of connected events on the subsequent 

4 connected subnet that follow from the current subnet; 

5 a component that assigns the subset of events to a subnet descendant superclass; and 

6 a component that adds the subnet descendant superclass to a descendant slot of the 

7 current subnet events. 
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9 1 . The system for the automated generation of a class definition and naming structure from an 
event relationship network of claim 89 further comprising a component that writes a plurality 
of generated classes to a data file. 

92. The system for the automated generation of a class definiuon and naming structure from an 
event relationship network of claim 86 further comprising a component that generates a 
generic correlation template. 

93. The system for the automated generation of a class definition and naming structure from an 
event relationship network of claim 92 further comprising a component that defines a path 
identification slot, a sequence identification slot, a descendant class and an ancestor class in 
a data file immediately descendant from a root cause event. 

94. The system for the automated generation of a class definition and naming structure from an 
event relationship network of claim 93 further comprising a component that propagates the 
path identification slot with a list of path numbers that an event is relevant to in the event 
relationship network. 

95. The system for the automated generation of a class definiuon and naming structure from an 
event relafionship network of claim 93 further comprising a component that fills the 
sequence identification slot with a sequence number for the path. 
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4 96. The system for the automated generation of a class definition and naming structure from an 

5 event relationship network of claim 93 further comprising a component that, for any event 

6 on a subnet which includes a primary subnet and that lies in a logical flow connected to the 

7 primary subnet, populates the ancestor class slot with a list of all subnet ancestor class 

8 names which are primary to the event and lie on the logical flow. 

1 97. The system for the automated generation of a class definition and naming structure from an 

2 event relationship network of claim 93 further comprising a component that, for any event 

3 on a subnet which includes a secondary subnet and that lies in a logical flow connected to 

4 the secondary event, populates the descendant class slot with a list of all subnet descendant 

5 class names which are secondary to the event and lie on the logical flow. 

1 ;^ 98. The system for the automated generation of a class definition and naming structure from an 

2 \^ event relationship network of claim 92 wherein the component that generates a generic 

3 p correlation template comprises: 

s 

4 for an event of a class within a subnet ancestor class: 

5 a component that makes a current event on the subnet a secondary event; and 

6 a component that removes the current event from correlation analysis; 

7 for an event of a class within a subnet descendant class: 

8 a component that makes the current event on the subnet a primary event; and 

9 a component that removes the current event from correlation analysis; 
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10 for an older event on the subnet in which the path identification of the current event 

1 1 intersects the path identification of the older event: 

12 a component that makes the current event on the subnet a primary event and 

13 removes it from correlation analysis, if the sequence identification of 

14 the current event is less than the sequence identification of the older 

15 event; and 

16 a component that makes the current event on the subnet a secondary event 

17 and removes it from correlation analysis, if the sequence 

18 ^ identification of the current event is greater than the sequence 

19 identification of the older event. 

1 99. The system for the automated generation of a class definition and naming structure from an 

2 " event relationship network of claim 94 wherein the component that propagates a of path 

3 \^ identification numbers includes: 

4 Q a component that, starting at a root node of the event relationship network, proceeds 

5 to a nodal event and defines a path leading in to the nodal event with a path 

6 identification number of one; 

7 a component that, at the nodal event, continues the inherited path leading in as one 

8 path leading out from the nodal event and assigns each remaining path 

9 leading out from the nodal event an ascending sequence of path identification 
10 numbers; 
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1 1 a component that proceeds to a next nodal event on any path leading out and assigns 

12 each remaining path leading out from the next nodal event an ascending 

13 sequence of path identification numbers; and 

14 a component that propagates the path identification numbers backwards to ensure 

15 that events on a path precedent to the nodal event are contained in the list for 

16 the path identification slot. 

1 100. The system for the automated generation of a class definition and naming structure from an 

2 event relationship network of claim 95 wherein the component that propagates sequence 

3 v3 identification numbers includes: 

4 a component that, starting at a root node of the event relationship network, assigns 

5 1 y the sequence numbers down a complete path; 

r;. 

6 ii a component that, for each nodal event, continues to assign sequence numbers for 

7 ^ U each node down any path by increasing a current sequence identification 

rU 

8 number of each nodal event; and 

9 '''^ a component that, if an event is fed by more than one incoming path, assigns the 

10 event a sequence number that is the highest of each incoming path and 

1 1 increases the sequence identification numbers of any events that follow a 

12 current nodal event in the logical sequence. 
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